published 2026-09-30
The package injects code that uses your logged-in WhatsApp session to silently subscribe your account to attacker-chosen channels. An attacker gains channel subscriptions under your identity without your consent.
Source: OSV
Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 2016 and your operating system.